Configuring MAC Address-based VLAN Assignment
Context
In MAC address-based VLAN assignment mode, you do not need to reconfigure VLANs for users when their physical locations change. This improves security and access flexibility on a network.
A switch that has MAC address-based VLAN assignment enabled processes only untagged frames, and treats tagged frames in the same manner as interface-based VLAN assignment.
If an entry is matched, the interface forwards the frame based on the VLAN ID and priority in the entry.
If no entry is found, the interface then uses other matching rules to match the frame.
The switch supports a maximum of 1024 MAC-VLAN entries and a maximum of 100 MAC-VLAN entries with the mask. The total number of MAC-VLAN entries is the number of configured MAC-VLAN entries multiplied by the number of interfaces where MAC-VLAN entries are delivered.
Procedure
- Run:
system-view
The system view is displayed.
- Run:
vlan vlan-id
A VLAN is created and the VLAN view is displayed. If the specified VLAN has been created, the VLAN view is directly displayed.
The VLAN ID ranges from 1 to 4094. If VLANs need to be created in a batch, run the vlan batch { vlan-id1 [ to vlan-id2 ] } &<1-10> command to create VLANs in a batch, and then run the vlan vlan-id command to enter the view of a specified VLAN.
If a device is configured with multiple VLANs, configuring names for these VLANs is recommended:
Run the name vlan-name command in the VLAN view. After a VLAN name is configured, you can run the vlan vlan-name vlan-name command in the system view to enter the corresponding VLAN view.
The vlan configuration command completes vLAN configurations when the VLAN is not created.
- Run:
mac-vlan mac-address mac-address [ mac-address-mask | mac-address-mask-length ] [ priority priority ]
A MAC address is associated with a VLAN.
When the mac-vlan mac-address command with the same MAC address specified is executed multiple times,MAC-VLAN entries take effect according to the longest match principle on X series cards,and the MAC-VLAN entry with the 48-bit mask has the highest priority. On other cards, MAC-VLAN entries take effect according to the longest match principle only when the mask has 47 bits or less than 47 bits, and the MAC-VLAN entry with the 48-bit mask has the lowest priority.
The MAC address is input in an H-H-H format, where each H is a hexadecimal number composed of 1 to 4 alphanumeric characters, such as 00e0 and fc01. If you enter less than four alphanumeric characters, 0s are added before the input digits. For example, if e0 is entered, 00e0 is displayed. The MAC address cannot be all Fs, all 0s, or a multicast MAC address.
- If a MAC-VLAN entry with the mask specified (excluding the 48-bit mask or mask with all Fs), run the undo mac-vlan mac-address command to delete the MAC-VLAN entry and then run the mac-vlan mac-address command to change the priority.
priority specifies the 802.1p priority of a MAC address-based VLAN. The value ranges from 0 to 7. A larger value indicates a higher priority. The default value is 0. After the 802.1p priority of a MAC address-based VLAN is specified, the switch forwards high-priority frames first during network congestion.
- Run:
quit
Return to the system view.
- Configure attributes for the Ethernet interface.
Run:
interface interface-type interface-number
The view of the interface that allows the MAC address-based VLAN is displayed.
Run:
port link-type hybrid
The interface is configured as the hybrid interface.
It is recommended that MAC address-based VLAN assignment should be configured on the hybrid interface.
Run:
port hybrid untagged vlan { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all }
On access and trunk interfaces, MAC address-based VLAN assignment can be used only when the MAC address-based VLAN is the same as the PVID. It is recommended that MAC address-based VLAN assignment be configured on hybrid interfaces.
- (Optional) Run:
vlan precedence mac-vlan
The device is configured to preferentially use MAC address-based VLAN assignment.
- Run:
mac-vlan enable
MAC address-based VLAN assignment is enabled.
By default, MAC address-based VLAN assignment is disabled.
MAC address-based VLAN assignment cannot be used with the MUX VLAN and MAC address authentication on the same interface.
MAC address-based VLAN assignment is invalid for packets with the VLAN ID of 0 only when the mask of the MAC VLAN is specified. On the X series cards, MAC address-based VLAN assignment is invalid for packets with the VLAN ID of 0 regardless of whether the mask of the MAC VLAN is specified.
Checking the Configuration
- Run the display mac-vlan { mac-address { all | mac-address [ mac-address-mask | mac-address-mask-length ] } | vlan vlan-id } command in any view to check the configuration of MAC address-based VLAN assignment.
- Run the display vlan command in any view to check information about VLANs.